I have a user with 5 failed login attempts...and now he's locked out. We reset his password...but is there something else we need to do to unlock his account on a basic Drupal 8 setup?

I'd rather not have to get into using drush on this remote server and messing around with db tables...especially since this is just one user out of thousands. I just want a simple UI solution.

Or does he have to wait 6 hours or something crazy?


2 Answers 2


If you use flood_unblock module you can just flush the flood for the specific user or ip.

  • Interesting...I may try this, thank you. I was hoping for some quick solution that didn't involve adding a module, but this may be the best way to go.
    – Sage
    Commented Aug 3, 2017 at 17:06

There's a default config for flood settings in core/modules/user/config/install/user.flood.yml:

uid_only: false
ip_limit: 50
ip_window: 3600
user_limit: 5
user_window: 21600

This means, that your user is locked for 21600 secs by default. Be patient :-) Unfortunately, there's no UI for that config currently. A workaround would be to import a single config in the Config-Sync UI.

All flood info is stored in table "flood". It's save to delete * from flood to reset all floodings. A flood info is by default ip-based like "uid-ip". So, if your user can change his client IP, she may be able to login before 21600 secs have passed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.